Executive brief
The Linux kernel's filesystem DAX (Direct Access) driver fails to properly clean up memory page map handlers when a device is unbound. This allows stale handler pointers to persist on shared memory structures, which could be invoked after the module is unloaded or the device is rebound to a different driver, potentially causing system crashes or unexpected behavior during memory error handling.
Technical details
The vulnerability exists in the dax/fsdev driver's probe/unbind lifecycle. The fsdev_dax_probe() function sets pgmap->ops and pgmap->owner to point to fsdev-specific handlers, but these are never cleared on unbind. For dynamic devices this is harmless since the page map is device-allocated and freed. However, for static devices the page map is shared and long-lived, owned by the DAX bus. After fsdev unbind, stale fsdev_pagemap_ops remain on the shared structure. If the device is subsequently rebound to device_dax (which installs no memory_failure handler) or the fsdev module is unloaded, a memory_failure event would dispatch through the dangling or freed handler, causing undefined behavior. The fix registers a devm cleanup action via devm_add_action_or_reset() to clear pgmap->ops and pgmap->owner on unbind, symmetrically nullifying what was set at probe time.
Affected products
- Linux Linux Kernel all versions with fsdev driver (Linux 6.10+)
Timeline
- 2026-09-17: disclosed: CVE-2026-93075 published
- 2026-06-15: patched: Upstream fix commit f48884ac31b6bfc99f36b3f207b8c0cbe5d54bd7
- 2026-09-14: patched: Backported to stable trees via commit 9b0f91dc9147a8601cec3d4d83cf13c6aaf71b27